How to Become an Accredited Service Provider (ASP) in the UAE

The UAE's Peppol-based e-invoicing system cannot run without Accredited Service Providers. Every business in scope must appoint one to issue, receive and report its invoices, and the Ministry of Finance (MoF) decides who qualifies. For software companies, ERP vendors and professional services firms, that creates a regulated market with a clear entry ticket.

The ticket is not cheap or quick. Accreditation combines Peppol network certification, two international ISO standards, insurance cover, a two-year product track record and a multi-stage MoF test programme. This guide sets out each requirement as of October 2026, the order to tackle them in, and how to decide whether to build your own platform or launch on someone else's.

What Is an Accredited Service Provider (ASP) in the UAE?

An Accredited Service Provider (ASP) is a company approved by the Ministry of Finance to exchange e-invoices over the Peppol network and report invoice data to the Federal Tax Authority (FTA) on behalf of businesses. In the UAE's five-corner model, the supplier's ASP is corner 2 and the buyer's ASP is corner 3.

Both ASPs validate the invoice against the UAE specification, called PINT AE, and each sends a tax data document to the FTA, which is corner 5. Ministerial Decision 243 of 2025 requires issuers and recipients to fulfil their exchange and reporting obligations through an ASP, so no in-scope business can comply without one.

The rules for becoming an ASP sit in Ministerial Decision 64 of 2025 on eligibility criteria and accreditation procedure, issued in March 2025. Ministerial Decision 56 of 2026, dated 10 May 2026, amended it, mainly to allow providers to use third-party products.

Who Is Eligible to Become a UAE ASP?

Eligibility rests on eight conditions in Article 5 of Decision 64: Peppol certification, experience, company registration, service provider requirements, tax registration, product information security, a self-declaration and insurance. All eight must be met by the entity that applies.

The MoF service page lists 15 supporting documents in total, including proof of e-invoicing experience, maintenance and support procedures, and the security specifications above. Collecting them is a project in itself, so start the evidence pack early.

What Does Peppol Certification Involve for a UAE ASP?

Peppol certification means joining OpenPeppol, signing a Service Provider Agreement with a Peppol Authority, passing the OpenPeppol testbed and obtaining a production PKI certificate. The MoF is the Peppol Authority for the UAE, as listed on peppol.org.

OpenPeppol's own guide to setting up an access point sets the sequence:

1. Join OpenPeppol by submitting the signed membership form and waiting for approval.
2. Sign the Service Provider Agreement with the Peppol Authority for the country where you are legally based, and send it with your company registration documents.
3. Request a test PKI certificate through the Peppol Service Desk.
4. Study the specifications: the eDelivery network rules (AS4 messaging, identifier policies) and the business specifications, which for the UAE means PINT AE Billing, PINT AE Self-Billing and the UAE Tax Data Document, all at version 1.0.4 on docs.peppol.eu as of October 2026.
5. Implement the access point, using open-source or commercial AS4 software or a hosted access point.
6. Run the onboarding tests in the OpenPeppol testbed. AS4 testing is mandatory for every Peppol service provider.
7. Request the production PKI certificate once the tests are approved, then go live on the network.

A UAE ASP also needs a Service Metadata Publisher (SMP) so that its customers' Peppol identifiers can be discovered. In the UAE, a business's identifier is the scheme 0235 followed by its 10-digit Tax Identification Number (TIN). If Peppol terms are new to you, our plain-English guide to Peppol explains access points, SMPs and the SML.

Why Do ISO 27001 and ISO 22301 Matter So Much?

They are hard eligibility conditions, and they usually take longer to achieve than the software build. ISO/IEC 27001 proves the security of your e-invoicing product; ISO 22301 proves you can keep the service running through a disruption.

The wording matters. Decision 64 asks for ISO/IEC 27001 certification for the PSP product, so a certificate scoped only to a head office or a different product line will not help. Auditors certify an information security management system that has been operating for a period, which means policies, risk assessments, internal audits and management reviews must exist before the certification audit, not after it.

ISO 22301 links directly to the obligations of your future customers. Each business must notify the FTA of a system failure within two business days, and the penalty for late notification is AED 1,000 per day under Cabinet Decision 106 of 2025. Customers will judge you on how quickly you detect, communicate and recover from outages.

What Are the Data Residency Requirements for UAE ASPs?

Decision 64 requires ASPs to comply with end-user-specific requirements on application and data hosting, storage, archival and residency, naming the national cloud security policy and the critical information infrastructure protection policy. In practice, your hosting design must satisfy the strictest customer you intend to serve.

This is more nuanced than a blanket rule. For businesses, Article 11 of Decision 243 requires e-invoices and associated data to be stored within the State, but the MoF's e-invoicing guidelines interpret that as being retrievable by the FTA on request, irrespective of where the servers sit. Government entities and critical infrastructure operators, however, may be bound by national cloud and security policies that do require UAE hosting.

A sensible architecture therefore offers UAE-region hosting as standard or as an option, keeps encryption keys under your control, and documents exactly where invoice payloads, logs and archives are stored. Expect procurement teams to ask.

What Are the Steps in the MoF Accreditation Process?

The process runs from an online application to pre-approval testing, production testing and the grant of accreditation. Applications are submitted only through the MoF website, using UAE Pass.

1. Prepare. Secure Peppol certification, ISO certificates, tax registrations and the evidence pack.
2. Apply. Use the MoF service "Accreditation of E-Invoicing Service Providers", log in with UAE Pass and upload the required documents. The MoF lists no fee for the service.
3. MoF review. Decision 64 commits the Ministry to a decision within 90 days; the service page lists a processing time of 90 working days.
4. Pre-approval testing. Interoperability, verification and tax data reporting tests, including setting up FTA test participants and trial integration with the FTA's systems.
5. Listing as pre-approved. Providers that pass the initial requirements appear on the MoF list as pre-approved while they complete the final production assessment.
6. Production testing. Live exchanges under Ministry supervision, with the Peppol production PKI certificate in place. Insurance proof is required after testing.
7. Accreditation. The Ministry grants accreditation and publishes the provider with an accreditation number.
8. Renewal. Accreditation lasts two years; the renewal application is due at least 70 days before expiry.

As of 6 October 2026, the MoF list showed 64 accredited providers and two pre-approved providers still in final assessment. That is a competitive field, and buyers compare ASPs closely, as our guide to choosing a UAE ASP shows.

How Long Does It Take to Become an ASP?

Plan in quarters rather than weeks. The fixed blocks are the MoF review of up to 90 days and the two-year product operating history; everything else depends on how much you already have.

The biggest timing drivers are:

• Product history. If your product has not operated for two years and no third-party product you use has, you cannot satisfy Article 5bis yet. This single rule decides many build-versus-white-label debates.
• ISO readiness. An existing ISO/IEC 27001 programme can be extended to the new product; starting from zero takes much longer.
• Peppol maturity. Existing Peppol access point operators in Europe or Asia-Pacific mainly need UAE-specific work: PINT AE validation, tax data reporting and FTA connectivity.
• Test cycles. Each failed pre-approval or production test adds a round of fixes and retesting with the Ministry.
• Market deadlines. Large businesses had to appoint an ASP by 30 October 2026; businesses under AED 50 million and government entities must appoint one by 31 March 2027. See the full UAE e-invoicing deadlines.

Should You Build Your Own ASP Platform or White-Label One?

Build if e-invoicing is core to your long-term product and you can wait for certification; white-label if speed to market and lower technical risk matter more. Decision 56 of 2026 made white-labelling explicit: a service provider may use a PSP product owned by a third party and outsource its development, operation or management, while retaining full responsibility.

Whichever route you take, the accredited entity answers to the MoF. Our deeper look at white-label ASP platforms covers contract terms and due diligence, and our playbook for audit, tax and advisory firms explains when becoming an ASP makes sense for a professional services business.

What Obligations Continue After Accreditation?

Accreditation is a licence to operate, not a finish line. Providers must keep every eligibility condition current, renew on time and run the service to the standard their customers' compliance depends on.

• Keep Peppol certification, PKI certificates, ISO certificates and insurance policies valid.
• Track PINT AE and tax data document updates published by the MoF and OpenPeppol.
• Notify affected businesses and the FTA of service disruptions; the MoF guidelines name a dedicated FTA support mailbox for this.
• Honour the social responsibility commitment in Decision 64 to provide 100 free e-invoice exchange and reporting services each year.
• Submit renewal at least 70 days before the two-year term ends.

How VEATEX Helps

VEATEX is a Shopify, web and software development agency that also builds Peppol e-invoicing platforms for the GCC, working with clients in the US, UK and the Gulf for over 11 years. We built a Peppol platform for a client that passed OpenPeppol testing and is now on the UAE pre-approved ASP list. For technology companies, audit and tax firms and ERP vendors, we design and build the platform layer: access point integration, PINT AE validation, tax data reporting, customer onboarding and ERP connectors, documented to support your ISO and MoF evidence. We serve the UAE and Oman today, with Qatar and the UK next on our roadmap. See our e-invoicing platform services or talk to our team.